PCI DSS penetration testing requirements

By Sam Rivera, Founder, SentinelPanda · June 19, 2026 · 2 min read · PCI DSS

A penetration test is not the same as an ASV scan, and not every merchant needs one. Here is what PCI actually requires and when.

Scan vs pen test

An ASV scan is an automated, quarterly external vulnerability scan that flags known weaknesses. A penetration test is a manual, objective-driven exercise where a tester actively tries to exploit weaknesses to reach cardholder data. PCI DSS requires both in the environments that call for them — they answer different questions: "what is exposed?" versus "can it actually be broken into?"

Who needs one

Penetration testing is a requirement for environments that store, process, or transmit cardholder data on their own systems — broadly SAQ D merchants, service providers, and any Report on Compliance. If you have fully outsourced payments and qualify for SAQ A, a pen test is generally not required by the SAQ itself, though a customer or acquirer may still ask.

What it must cover

• External and internal testing across the network layer and the application layer of the in-scope environment.
• Validation of segmentation: testing that out-of-scope systems genuinely cannot reach the CDE — the test that justifies your reduced scope.
• Remediation and re-testing of exploitable findings, with the report and evidence retained.

How often

At least once a year, and after any significant change to the environment — a new system in the CDE, a major application release, a network re-architecture. Service providers that rely on segmentation are expected to validate it more frequently. Scope the test to the CDE and its boundaries rather than your entire company, and you keep the cost proportionate.

Know whether it applies to you first

Buying a pen test you do not need is a common SMB mistake. Confirm your SAQ type with the free SAQ finder — it tells you which requirements (including testing) actually apply to how you take payments, so you spend on what your validation path requires and nothing more.